There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed.

That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.